Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:74417
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.181 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAEp07h-XDvb+LVSw3mT7GOwBf99YNKR91eD0JuLa6xQYFJ+91w@mail.gmail.com>
References: <CAOg_pRQxKsJPgFaZ6_y7Rf1i4Bfkbx+FhCxuBtE9PWu58uOfOQ@mail.gmail.com>
	<6048BA05-CC13-46DD-8439-9CB4EE29078B@ajf.me>
	<9EBA95A7-B9F7-41F0-AE2B-283260753E5A@googlemail.com>
	<B58A4DF4-52FE-41D9-896C-5396DDC7CB8B@ajf.me>
	<CAOg_pRSmVdw1Y9g-RrW8dBNSpBZVHavJQzSGUCjZu5wXhuUMCQ@mail.gmail.com>
	<537CBD67.4000008@lerdorf.com>
	<CAEp07h-XDvb+LVSw3mT7GOwBf99YNKR91eD0JuLa6xQYFJ+91w@mail.gmail.com>
Date: Wed, 21 May 2014 22:06:30 +0200
Message-ID: <CAOg_pRTTutCvsBhDuVvgHads-RM9EHveE0V2aO+Yu=b-L5qZ5g@mail.gmail.com>
To: Martin Keckeis <martin.keckeis1@gmail.com>
Cc: Rasmus Lerdorf <rasmus@lerdorf.com>, PHP internals <internals@lists.php.net>, 
	Kevin Ingwersen <ingwie2000@googlemail.com>, Andrea Faulds <ajf@ajf.me>
Content-Type: multipart/alternative; boundary=089e0158bbdc41038004f9ee883a
Subject: Re: [PHP-DEV] encode php scripts with opcache compatibility
From: nicolai.scheer@gmail.com (Nicolai Scheer)

--089e0158bbdc41038004f9ee883a
Content-Type: text/plain; charset=UTF-8

Hi!

On 21 May 2014 21:40, Martin Keckeis <martin.keckeis1@gmail.com> wrote:

> Am 21.05.2014 16:51 schrieb "Rasmus Lerdorf" <rasmus@lerdorf.com>:
> >
> > On 5/21/14, 7:27 AM, Nicolai Scheer wrote:
> > > Hi,
> > >
> > > yes, we are shipping code to customers and they should not read the
> source.
> > > The level of protection gained from obfuscated code is not enough, but
> just
> > > delivering the opcodes would be ok.
> > >
> > > I know that the opcode array might be dumped, this is just to raise the
> > > bar. If I just obfuscate the code there's still the possibilty left to
> edit
> > > the code directly.
> > >
> >
> > It is completely trivial to turn opcodes back into PHP code. Sure, it
> > won't look exactly like the original, but it will run exactly the same
> > and can easily be modified. There are tools out there that let even a
> > complete neophyte do it.
> >
> > If you truly want to protect your code, ship a signed compiled C/C++
> > extension and put key components of your application in it. That is much
> > harder to reverse (anything can be reversed, of course) and it has the
> > added advantage of likely making your application faster.
> >
> > -Rasmus
> >
>
> Wasnt there zend guard sometime ago for this?
>

Zen guard is not an option, since it currently does not work with php 5.5.
It did not check if the encoded scripts for php 5.4 are usable with
opcache, though. Might be, because opcache was made out of ZendOptimizer+
if I remember correctly.

Greetings

Nico

--089e0158bbdc41038004f9ee883a--